Read the analysis pipeline stages#
Check which stages ran on the file, what each one reported, and how a skipped stage differs from one that returned nothing.
The Analysis pipeline card at the bottom of the Overview tab shows every stage that ran on the file, in order, with the headline result of each stage.
Why this card exists#
The card answers the question 'what did the analyser do for this file'. If a stage did not run, you see that immediately. If a stage produced an unusual headline, you see that too.
The six stages#
The stages appear in a fixed order, even when a stage produced nothing.
- Intake records how the file got into the workspace, usually
localfor files you opened by hand. - Static shows the entropy as
entropy <value>. The value comes from the byte stream. - PE runs only for PE files. The headline is the import count, or a packer name when the analyser detected one.
- ZIP runs only for archive formats. The headline is
parsedwhen the parser could read the central directory. Otherwise the headline is an error. - YARA shows the number of matched rules, or a dash when you have not run YARA yet.
- OCR shows the OCR result for image files. It stays blank until you start OCR from the OCR tab.
What the dashes and n/a mean#
A dash or n/a under a stage means the analyser skipped the stage because the file did not match it. A parsed 0 (for archives) or 0 hits (for YARA) means the stage ran but produced an empty result. They are not the same thing.